Merge pull request #835 from sharelatex/sk-sanitize-system-messages

Sanitize display of system messages.

services/web/app/views/admin/index.pug

@@ -10,8 +10,8 @@ block content
 							h1 Admin Panel
 						tabset(ng-cloak)
 							tab(heading="System Messages")
-								each message in systemMessages 
-									.alert.alert-info.row-spaced !{message.content}
+								each message in systemMessages
+									.alert.alert-info.row-spaced #{message.content}
 								hr
 								form(enctype='multipart/form-data', method='post', action='/admin/messages')
 									input(name="_csrf", type="hidden", value=csrfToken)

services/web/public/coffee/main/system-messages.coffee

@@ -6,8 +6,8 @@ define [
 		
 	App.controller "SystemMessageController", ($scope, $sce) ->
 		$scope.hidden = $.localStorage("systemMessage.hide.#{$scope.message._id}")
-		$scope.htmlContent = $sce.trustAsHtml $scope.message.content
+		$scope.htmlContent = $scope.message.content
 		
 		$scope.hide = () ->
 			$scope.hidden = true
-			$.localStorage("systemMessage.hide.#{$scope.message._id}", true)
+			$.localStorage("systemMessage.hide.#{$scope.message._id}", true)